CWE-367: TOCTTOU
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Also known as Time-of-check Time-of-use (TOCTOU) Race Condition, TOCCTOU.
A kind of CWE-362 Race Condition.
From the CWE List. © The MITRE Corporation.
Newest
- akamai guardicore platform agent, zero trust client +1 moreAkamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU...7.4 High
- No product listedThe socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver...7.8 High
- spring cloud config, vmware spring cloud config +1 moreSpring Cloud Config Server Susceptible To TOCTOU Attack7.4 High
- gotenbergGotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes5.3 Medium
- sandboxie-plus sandboxieSandboxie-Plus local privilege escalation via TOCTOU race condition in UpdUtil addon installation5.4 Medium
- chatchat-space langchain-chatchatchatchat-space Langchain-Chatchat OpenAI-Compatible File Upload API openai_routes.py files toctou2.1 Low
- papercut mf, ng, ng/mf +2 morePaperCut MF: Card truncation on HP readers4.1 Medium
- @turbo workspacesLocal Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent8.5 High
- openclawOpenClaw < 2026.4.22 - Time-of-Check/Time-of-Use Race Condition in OpenShell FS Bridge8.3 High
- openclawOpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writes8.4 High
- qualcomm cq7790 firmware, cq8725s firmware, fastconnect 6200 firmware +98 more +100 moreTime-of-check Time-of-use (TOCTOU) Race Condition in DSP Service7.8 High
- prefecthq prefectPrefectHQ prefect Webhook/Notification validate_restricted_url toctou2.3 Low
- linux, linux kernel +1 morexfs: close crash window in attr dabtree inactivation4.7 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenet/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()7.8 High
- linuxfoundation automotive grade linuxAGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22)...9.8 Critical
- wazuhWazuh: API brute-force protection bypass via race condition in login attempt tracking6.5 Medium
- linux, linux kernel +1 moreopenvswitch: defer tunnel netdev_put to RCU release7.8 High
- linux, linux kernel +1 moresmb: client: make use of smbdirect_socket.recv_io.credits.available4.7 Medium
- uutils coreutilsuutils coreutils chcon Security Bypass and Mandatory Access Control (MAC) Inconsistency via TOCTOU Race Condition4.5 Medium
- uutils coreutilsuutils coreutils split Arbitrary File Truncation via Time-of-Check to Time-of-Use (TOCTOU) Race Condition6.3 Medium
- uutils coreutilsuutils coreutils mv Arbitrary File Overwrite via Cross-Device TOCTOU Race Condition6.3 Medium
- uutils coreutilsuutils coreutils Missing TOCTOU Protection on Non-Linux Unix Platforms in Safe Traversal Module3.6 Low
- uutils coreutilsuutils coreutils touch Arbitrary File Truncation via TOCTOU Race Condition6.3 Medium
- uutils coreutilsuutils coreutils cp Information Disclosure via Time-of-Check to Time-of-Use Symlink Swap4.7 Medium
- uutils coreutilsuutils coreutils cp Information Disclosure via Permission Handling Race4.7 Medium
- uutils coreutilsuutils coreutils install Arbitrary File Overwrite with -D via Path Component Symlink Race6.3 Medium
- uutils coreutilsuutils coreutils install Arbitrary File Overwrite via Symlink TOCTOU Race6.3 Medium
- uutils coreutilsuutils coreutils mv Security Xattr TOCTOU Race in Cross-Device4.7 Medium
- uutils coreutilsuutils coreutils mkdir Permission Exposure Race Condition with -m3.3 Low
- uutils coreutilsuutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition7.0 High
- uutils coreutilsuutils coreutils tail Privileged Information Disclosure via Symlink Replacement Race5.3 Medium
- linux, linux kernel +1 morenvme-pci: ensure we're polling a polled queue4.7 Medium
- packagekit, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 morePackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root8.8 High
- suse opensuse tumbleweedcsync2 uses insecure temporary directories when compiled with C99 or later5.1 Medium
- spring security, vmware spring security +1 moreSpring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions4.8 Medium
- openprojectOpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup6.5 Medium
- gnu sedRace Condition in GNU Sed2.1 Low
- openclawOpenClaw < 2026.4.10 - DNS Rebinding SSRF via Hostname Validation Bypass4.9 Medium
- flowiseai flowise, flowise-components +1 moreFlowise: SSRF Protection Bypass (TOCTOU & Default Insecure)7.1 High
- openclawOpenClaw < 2026.4.10 - Time-of-Check-Time-of-Use (TOCTOU) Race Condition in exec Script Preflight Validator2.0 Low
- asus member center(华硕大厅)A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member...5.4 Medium
- asus driverhubAn Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub...5.4 Medium
- mattermost, mattermost server +1 moreRace Condition in Guest Magic Link Authentication Allows Token Reuse6.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability7.0 High
- espocrmEspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access3.5 Low
- libcap project libcap, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +34 more +36 moreLibcap: libcap: privilege escalation via toctou race condition in cap_set_file()6.7 Medium
- openclawOpenClaw < 2026.4.2 - Approval Integrity Bypass in pnpm dlx Local Script Binding5.4 Medium
- homarrHomarr has a Race Condition in Invite Token Registration (TOCTOU)4.2 Medium
- kernel util-linuxutil-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup4.7 Medium
- Show moreLoading…